Hidden CLI functionality enables unauthenticated compromise of WAGO managed switches

An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.

The structured affected data identifies these ranges as affected:

• Lean Managed Switch 852-1812: affected <V1.2.1.S0.
• Lean Managed Switch 852-1813: affected <V1.2.1.S0.
• Lean Managed Switch 852-1813-000-001: affected <V1.2.3.S0.
• Lean Managed Switch 852-1816: affected <V1.2.1.S0.
• Industrial Managed Switch 852-303: affected <V1.2.8.S0.
• Industrial Managed Switch 852-1305: affected <V1.2.0.S0.
• Industrial Managed Switch 852-1305-000-001: affected <V1.2.0.S0.
• Industrial Managed Switch 852-1505-000-001: affected <V1.2.0.S0.
• Industrial Managed Switch 852-1505: affected <V1.1.9.S0.
• Industrial Managed Switch 852-602: affected <V1.0.6.S0.
• Industrial Managed Switch 852-603: affected <V1.0.6.S0.
• Industrial Managed Switch 852-1605: affected <V1.2.5.S0.
• Lean Managed Switch 852-1812-010-000: affected <V1.2.1.S0.
• Lean Managed Switch 852-1813-010-000: affected <V1.2.1.S0.
• Lean Managed Switch 852-1816-010-000: affected <V1.2.1.S0.
• Lean Managed Switch 852-1813/010-001: affected <V1.2.1.S0.

The CNA affected-product table additionally lists the corresponding .S0 firmware as affected for the other 15 models. For Lean Managed Switch 852-1813/010-001, the table lists V1.2.1.S1 as affected while the remediation table names the same release as fixed. This is an internal CNA-source conflict, so the status of that boundary requires confirmation from WAGO or CERT@VDE.

WAGO Managed Switches contain a hidden function in the CLI prompt, placing the issue in CWE-912 Hidden Functionality. The record describes a network attack path in which an unauthenticated remote attacker interacts with the CLI prompt, escapes the restricted interface, and can fully compromise the device. The supplied attack properties indicate that no initial privileges or user interaction are required and that attack complexity is low. The supplied record additionally characterizes the result as root access to the underlying Linux operating system. The invocation method, transport or service providing the CLI, input format, and exact implementation component are not described in the inspected public material.

The vulnerability is remotely reachable over the network and does not require authentication or user interaction. The supplied record characterizes attack complexity as low, so devices with network-exposed management CLI access should receive priority review. The record sets public_exploit to false and known_exploited to null; the inspected CNA advisory does not document public exploit code, a campaign, or specific indicators. These metadata values do not prove that the vulnerability has never been exploited.

Exploitation can allow an attacker to bypass the restricted interface and obtain full compromise of the device. The supplied record additionally describes root access to the underlying Linux operating system, but the public material does not define the specific post-exploitation actions. Possible consequences include disclosure of device data, unauthorized configuration changes, and disruption of network operations. The attack is characterized as crossing the original restricted-interface boundary, but the exact affected system scope is not publicly described.

Successful exploitation can result in full system compromise of an affected switch. This could expose device data, permit unauthorized changes to configuration or switching behavior, and disrupt network services. Because the attack does not require authentication, an exposed management interface can materially increase operational risk. The advisory does not document the exact post-compromise actions available to an attacker.

1. Update each model to the fixed firmware specified by the CNA advisory:

• Lean Managed Switch 852-1812: V1.2.1.S1.
• Lean Managed Switch 852-1813: V1.2.1.S1.
• Lean Managed Switch 852-1813/000-001: V1.2.3.S1.
• Lean Managed Switch 852-1816: V1.2.1.S1.
• Industrial Managed Switch 852-303: V1.2.8.S1.
• Industrial Managed Switch 852-1305: V1.2.0.S1.
• Industrial Managed Switch 852-1305/000-001: V1.2.0.S1.
• Industrial Managed Switch 852-1505/000-001: V1.2.0.S1.
• Industrial Managed Switch 852-1505: V1.1.9.S1.
• Industrial Managed Switch 852-602: V1.0.6.S1.
• Industrial Managed Switch 852-603: V1.0.6.S1.
• Industrial Managed Switch 852-1605: V1.2.5.S1.
• Lean Managed Switch 852-1812/010-000: V1.2.1.S1.
• Lean Managed Switch 852-1813/010-000: V1.2.1.S1.
• Lean Managed Switch 852-1813/010-001: V1.2.1.S1.
• Lean Managed Switch 852-1816/010-000: V1.2.1.S1.

1. After updating, verify the device model and running firmware on each asset and confirm that the device booted the specified firmware.
2. For Lean Managed Switch 852-1813/010-001, do not treat the status of V1.2.1.S1 as unambiguous. The CNA table lists that release as both affected and fixed, so confirm the boundary directly with WAGO or CERT@VDE.
3. If immediate firmware replacement is not possible, restrict remote access to the management plane and CLI as a precaution. The inspected advisory does not provide a product-specific workaround, so this does not replace the firmware fix.
4. The fixed firmware listed above is the exact release identified by the advisory. The inspected material does not establish the status of every later release or parallel branch.

1. Inventory WAGO assets by model number, covering all listed Lean Managed Switch and Industrial Managed Switch models.
2. Check the firmware running on each device and compare it with the affected boundaries and fixed firmware listed below.
3. Determine whether the device CLI or management plane is reachable from untrusted networks. This is an exposure check, not a CNA-confirmed indicator.
4. Review management connection logs and unusual access attempts to the CLI prompt where the product records those events. The advisory does not provide named log events, detection strings, or IOCs.
5. Do not treat the absence of suspicious log entries as proof that a device is safe, because the public material does not describe logging for the attack path.